Description
A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when the openlog function was not called, or called with the ident argument set to NULL, and the program name (the basename of argv[0]) is bigger than 1024 bytes, resulting in an application crash or local privilege escalation. This issue affects glibc 2.36 and newer.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | glibc | — | 2.39 |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Fedora | Fedora | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | glibc | 2.37-15 | — |
| Debian 13 | glibc | 2.37-15 | — |
| Debian 12 | glibc | 2.36-9+deb12u4 | DSA-5611-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | glibc | 2.39-0ubuntu1 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | glibc | 2.39-1.2 | openSUSE-SU-2024:13647-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | glibc | 2.38-6 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | glibc | 2.38-r11 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
elpe-pinillo/CVE-2023-6246 ★ 8 · Mar 2, 2024
-
SimoesCTT/CTT-Vsyslog-Vortex-CVE-2023-6246 ★ 0 · Apr 6, 2026
CVE-2023-6246 glibc __vsyslog_internal() heap buffer overflow exploitation using Convergent Time Theory (α = 0.0302011). 33-layer temporal heap spray + phase-locked trigger for reliable local privile…
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 7
- SSA-082556 SSA-082556: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.5 Siemens ProductCERT · Oct 13, 2026
- WID-SEC-2024-0246 GNU libc: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 15, 2026
- ICSA-25-162-05 Siemens SIMATIC S7-1500 CPU family CISA ICS & IT advisories · May 14, 2026
- DSA-5611-1 glibc - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:13647-1 glibc-2.39-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- NCSC-2025-0187 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Jun 10, 2025
- WID-SEC-2024-0897 Oracle Hyperion: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 16, 2024
References
- http://packetstormsecurity.com/files/176931/glibc-qsort-Out-Of-Bounds-Read-Write.html
- http://packetstormsecurity.com/files/176932/glibc-syslog-Heap-Based-Buffer-Overflow.html
- http://seclists.org/fulldisclosure/2024/Feb/3
- http://seclists.org/fulldisclosure/2024/Feb/5
- https://access.redhat.com/security/cve/CVE-2023-6246 vdb-entry
- RHBZ#2249053 issue-tracking
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D2FIH77VHY3KCRROCXOT6L27WMZXSJ2G/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MWQ6BZJ6CV5UAW4VZSKJ6TO4KIW2KWAQ/
- https://security.gentoo.org/glsa/202402-01
- https://www.openwall.com/lists/oss-security/2024/01/30/6
- https://www.qualys.com/2024/01/30/cve-2023-6246/syslog.txt
- https://security.netapp.com/advisory/ntap-20240216-0007/